diff --git a/charts/agent-controller/Chart.lock b/charts/agent-controller/Chart.lock index 6219bff..21bd2b1 100644 --- a/charts/agent-controller/Chart.lock +++ b/charts/agent-controller/Chart.lock @@ -5,6 +5,9 @@ dependencies: - name: core-controller repository: file://charts/core-controller version: 0.1.0 +- name: temporal-engine + repository: file://charts/temporal-engine + version: 0.1.1 - name: integration-gateway repository: file://charts/integration-gateway version: 0.1.0 @@ -14,5 +17,5 @@ dependencies: - name: nats repository: https://nats-io.github.io/k8s/helm/charts/ version: 2.14.2 -digest: sha256:328c0678a640e98589cf6f96b28bc82931dffab1dbe78185e078d686dd2dbfc5 -generated: "2026-07-20T06:08:05.149497-07:00" +digest: sha256:571058ff9cac13b57a9e36b07e9a866cca84904a0411bffde4b556f3ea1cea7b +generated: "2026-08-06T18:08:32.066566-07:00" diff --git a/charts/agent-controller/Chart.yaml b/charts/agent-controller/Chart.yaml index 70976a8..3aedcab 100644 --- a/charts/agent-controller/Chart.yaml +++ b/charts/agent-controller/Chart.yaml @@ -9,7 +9,7 @@ description: >- one release. Install the community-components chart afterward to populate the catalog with Tool/Skill/Agent CRs. type: application -version: 0.3.0 +version: 0.4.0 appVersion: "0.1.0" home: https://github.com/imaustink/agent-controller sources: @@ -38,13 +38,13 @@ dependencies: version: "0.1.0" repository: "file://charts/core-controller" condition: core-controller.enabled - # The Temporal-workflow agent engine (engines/temporal), docs/adr/0036. OFF - # by default: agent-orchestrator runs its in-process LangGraph loop unless - # AGENT_ENGINE=temporal selects this instead, so enabling the subchart alone - # changes no behaviour. Takes a Temporal address rather than bundling a - # server, so it adds no stateful component. + # The Temporal-workflow agent engine (engines/temporal), docs/adr/0036. ON, + # and paired with agent-orchestrator.config.agentEngine=temporal in values -- + # deploying the subchart is only half the switch, since the orchestrator + # picks its loop independently. Takes a Temporal address rather than bundling + # a server, so it adds no stateful component. - name: temporal-engine - version: "0.1.0" + version: "0.1.1" repository: "file://charts/temporal-engine" condition: temporal-engine.enabled # GitHub Issues adapter (apps/integration-gateway) -- phase 1 of diff --git a/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml b/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml index e4dcf7d..2622df9 100644 --- a/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml +++ b/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml @@ -78,6 +78,23 @@ spec: - name: AGENT_TEMPORAL_ENGINE_URL value: {{ .Values.config.temporalEngineUrl | quote }} {{- end }} + {{- if and .Values.config.agentEngine .Values.secrets.temporalEngineTokenKey }} + # Bearer token presented to the engine gateway, which resolves it + # to a subject and ROLES against its own static identity map. The + # engine re-resolves every skill/agent target under those roles, so + # without a token that the gateway recognises it falls closed to + # zero capabilities and every turn is denied. + # + # Optional, because the alternative to a token is the gateway's + # defaultSubject/defaultRoles rather than a broken pod — but one of + # the two has to be configured for a turn to resolve anything. + - name: AGENT_TEMPORAL_ENGINE_TOKEN + valueFrom: + secretKeyRef: + name: {{ .Values.secrets.existingSecret | default (include "agent-orchestrator.fullname" .) }} + key: {{ .Values.secrets.temporalEngineTokenKey }} + optional: true + {{- end }} {{- if .Values.config.callerToolTtlSeconds }} - name: AGENT_CALLER_TOOL_TTL_SECONDS value: {{ .Values.config.callerToolTtlSeconds | quote }} diff --git a/charts/agent-controller/charts/agent-orchestrator/values.yaml b/charts/agent-controller/charts/agent-orchestrator/values.yaml index b8b25d5..ff418e3 100644 --- a/charts/agent-controller/charts/agent-orchestrator/values.yaml +++ b/charts/agent-controller/charts/agent-orchestrator/values.yaml @@ -205,6 +205,14 @@ secrets: # absent from the Secret the orchestrator falls back to trusting the # unsigned request-body login and warns at startup. senderAssertionSecretKey: AGENT_SENDER_ASSERTION_SECRET + # Only used when config.agentEngine is set above. The engine gateway maps + # this token to a subject and ROLES, and re-resolves every skill/agent target + # under them, so an unrecognised or absent token leaves a turn with no + # capabilities. Must match an entry in that gateway's + # identity.staticIdentities — or be left out in favour of its + # defaultSubject/defaultRoles, which is the other way to give the hop an + # identity. + temporalEngineTokenKey: AGENT_TEMPORAL_ENGINE_TOKEN # Only read when secrets.create=true. openaiApiKey: "" callbackSecret: "" diff --git a/charts/agent-controller/charts/temporal-engine/Chart.yaml b/charts/agent-controller/charts/temporal-engine/Chart.yaml index 209ab52..fad74fa 100644 --- a/charts/agent-controller/charts/temporal-engine/Chart.yaml +++ b/charts/agent-controller/charts/temporal-engine/Chart.yaml @@ -2,12 +2,12 @@ apiVersion: v2 name: temporal-engine description: >- The Temporal-workflow agent engine (engines/temporal) — worker, gateway and - catalog-sync. Off by default: agent-orchestrator runs its in-process - LangGraph loop unless AGENT_ENGINE=temporal selects this instead - (docs/adr/0036). Assumes a Temporal cluster is already reachable and takes - its address, so enabling this adds no stateful component. + catalog-sync. Runs a turn only when agent-orchestrator is also told to use it + with AGENT_ENGINE=temporal (docs/adr/0036); deploying this alone leaves the + in-process LangGraph loop serving every turn. Assumes a Temporal cluster is + already reachable and takes its address, so this adds no stateful component. type: application -version: 0.1.0 +version: 0.1.1 appVersion: "0.1.0" home: https://github.com/imaustink/agent-controller sources: